@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.2

package/docs/reusable-build-surface.md

@@ -102,6 +102,36 @@ The router is generated from `.build.yml`'s input/output surface. Run
 `node scripts/generate-channel-build-workflow.mjs` after changing the advanced
 build workflow; inventory and unit tests reject a stale generated router.
 
+### v4 floating consumer admission
+
+The v4 public surfaces add a source policy gate before dependency setup, matrix
+planning, build, publication, or promotion work. Tracked caller YAML may use
+only `@v4` or `@v4-alpha`, and the repository must commit both
+`.buildchain/contract-lock.json` and `.buildchain/alpha-contract-lock.json`.
+Source-persisted exact SHAs, exact defaults, repository/input/environment
+indirection, nested composite indirection, a missing lock, or a stale selected
+lock fail closed.
+
+Admission emits a rooted receipt binding the caller source, public workflow,
+visible selector and workflow-shell SHA, actual runtime SHA, both lock roots,
+and policy/scanner roots. A trusted `workflow_dispatch` train or SHA remains a
+non-persistent runtime override: the tracked floating selector and its selected
+lock still bind the visible workflow shell. Release-candidate evidence carries
+the receipt; promotion certifies it independently; final v4 Release Passport
+construction requires the matching certification.
+
+Transient train, authority, and exact-SHA selections additionally produce a
+provider-readback-bound runtime authorization receipt. A resumed failed tail
+uses a fresh attempt and records the original build runtime, the resume runtime,
+the exact sealed Stage Capsules reused per platform, and the platforms rebuilt
+in the final Release Passport. See
+[`v4-runtime-ref-resume-authority.md`](v4-runtime-ref-resume-authority.md).
+
+See the normative
+[`v4 floating consumer policy`](../architecture/v4-floating-consumer-policy.md)
+and its machine declaration for the exact acceptance boundary. This policy does
+not change v3 behavior.
+
 ## Advanced Workflow
 
 Consumers that need direct workflow-shell or runtime control call the advanced
@@ -699,6 +729,17 @@ For a declared macOS `archive`, the authority safely extracts the sealed
 container, signs and verifies every Mach-O payload, signs Mach-O payloads inside
 embedded Python wheels, rebuilds each affected wheel's PEP 427 `RECORD`, and
 recreates the original zip or tar.gz before returning the exact final bytes.
+Archives whose executable hosts a JIT runtime can additionally request the
+Buildchain-owned `entitlements_profile = "jit-executable-v1"` and exact paths,
+for example `entitlements_paths = ["product/runtime/python/bin/python3"]`.
+Paths are relative to the extracted archive root. The authority
+then attaches only `com.apple.security.cs.allow-jit` to the exact executable
+Mach-O files sealed in `entitlements_paths`, leaves every other executable and
+library without exception entitlements, and records the profile, paths, and
+entitled executable count in provider evidence. Consumer-provided entitlement
+files and wildcard target paths are unsupported. The profile is valid only for
+Apple `archive` requests and fails closed on an unsafe, missing,
+non-executable, duplicate, or unsealed target path.
 Windows `pe` and `binary` artifacts
 resolve to timestamped native `windows-authenticode`; Windows PE never falls
 back to a detached signature. Linux and other non-native binary files,

package/docs/runtime-train-validation.md

@@ -176,3 +176,13 @@ actions, configuration parsing, and lifecycle behavior. It cannot validate
 changes that require the outer reusable workflow YAML itself to change, such as
 new jobs, permissions, workflow outputs, or matrix topology. Those changes need
 a canary workflow path or a temporary explicit workflow ref.
+
+## v4 persisted-selector boundary
+
+For v4 consumers, never commit a train or exact SHA in a `uses` node. Keep the
+caller on `@v4` or `@v4-alpha`, retain both stable and alpha contract locks, and
+pass a temporary train/SHA only through the trusted `workflow_dispatch`
+`buildchain-ref` input. Consumer admission binds the selected lock to the exact
+workflow-shell commit while recording the separately resolved runtime SHA.
+Therefore a train can exercise candidate runtime code without weakening the
+durable floating-selector policy or masquerading as a channel promotion.

package/docs/v4-runtime-ref-resume-authority.md

@@ -0,0 +1,69 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-v4-runtime-ref-resume-authority
+doc_type: contract-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-08-15
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-14
+  invisible_context: not asserted
+---
+
+# Buildchain v4 transient runtime and resume authority
+
+Buildchain v4 consumers keep `v4` or `v4-alpha` in tracked workflow source.
+A train, authority ref, or exact SHA is transient run data, never a new
+committed default. The public promotion router accepts that escape only from a
+trusted `workflow_dispatch` actor with write, maintain, or admin permission.
+Before heavy promotion work, it binds an exact source tree, operator reason,
+dual consumer contract-lock roots, the floating-consumer policy receipt, a
+clean persistence scan, and GitHub provider readbacks proving that the selected
+runtime is reachable from an approved v4 ref.
+
+The persistence scan covers tracked workflow, composite-action, JSON, TOML, and
+YAML surfaces. Exact SHA, train/authority defaults, and runtime selectors hidden
+through repository variables, secrets, or environment indirection reject the
+run. OIDC, IAM, and other external authority references are inventoried as
+metadata only; credential values are never read or written to evidence.
+
+## Resume after a floating ref moves
+
+A late platform failure is resumed as a new governed attempt. It is not a
+GitHub failed-job rerun. The lineage keeps runtime A (the runtime that built and
+sealed each reusable Stage Capsule) separate from runtime B (the authorized
+runtime executing the new attempt). A Capsule is reusable only when its source
+SHA, source tree, platform, policy root, build runtime, identity root, Capsule
+root, and artifact digest still match. Valid unaffected platforms are restored;
+only missing platforms rebuild. Stale, ambiguous, unsealed, cross-source, or
+cross-policy evidence fails closed.
+
+This deliberately does not weaken the existing Stage Capsule resume planner's
+`runtime-changed` invalidation. That planner decides whether a stage may be
+reused under one expected build identity. This contract instead proves that an
+already sealed output built under runtime A remains the exact product input
+while a distinct orchestration attempt runs under runtime B. Runtime B never
+rewrites the Capsule's build identity.
+
+Final Release Passport evidence embeds the complete authorization receipt and
+the A+B resume lineage under `v4RuntimeResume`. The section binds the new
+attempt, floating-ref movement, reused and rebuilt platform partition,
+consumer-policy receipt, resume plan, and final public readback roots. Tampering
+with either document or crossing authorization/lineage roots rejects Passport
+construction and verification.
+
+Normative files:
+
+- `architecture/v4-runtime-ref-resume-authority.json`
+- `contracts/v4-runtime-ref-resume-authority-v1.schema.json`
+- `packages/core/v4-runtime-ref-resume-authority.js`
+- `scripts/authorize-promotion-runtime-override.cjs`
+
+This contract changes no v3 behavior, grants no provider mutation authority,
+and stores no credential material.

package/docs/versioning.md

@@ -79,6 +79,7 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| 2026-08-14 | extend-minor | `v4.0`  | source-qualification-proof-v2, source-proof-reuse-decision, reusable-check-workflow                                                                                           | additive | Forward-port opt-in exact accepted source-proof reuse for merge groups, binding source, base, patch, runtime, plan, policy, closure, dependency, required-context, producer receipt, and caller run. Any missing or changed predicate fails closed to the existing full source lifecycle, which remains the default.                      |       |
 | 2026-08-11 | extend-minor | `v4.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export                                                 | additive | Forward-port rooted successor candidate generations, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, and the narrow non-preemptive Warrant blocker lane already protected and self-dogfood-proven on v3.                                                               |       |
 | 2026-08-10 | extend-minor | `v4.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                | additive | Forward-port the provider-neutral rooted Release Cut and idempotent Release Train state contract already proven on v3; candidate, tree, Alpha base, runtime, generation, and authority stay frozen while later Dev movement remains an observation rather than implicit supersession.                                                   |       |
 | 2026-08-08 | extend-minor | `v4.0`  | dev-delivery-warrant-read-candidate, rust-state-projection, dev-delivery-cli                                                                                                 | additive | Add an opt-in, qualification-bound read projection behind `observe --read-mode v4`; v3 remains the sole writer and default reader, mutation commands ignore the switch, failures stop, and rollback is the explicit caller change back to v3.                                                                                          |       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.0",
+  "version": "4.0.1-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -40,6 +40,8 @@
     "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
     "./readme-badges": "./packages/core/readme-badges.js",
     "./public-surface-audit": "./packages/core/public-surface-audit.js",
+    "./v4-floating-consumer-policy": "./packages/core/v4-floating-consumer-policy.js",
+    "./v4-runtime-ref-resume-authority": "./packages/core/v4-runtime-ref-resume-authority.js",
     "./logging": "./packages/core/logging.js",
     "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
@@ -123,10 +125,10 @@
   "packageManager": "pnpm@11.7.0",
   "scripts": {
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs packages/core/v4-canonical-contracts.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
+    "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs packages/core/v4-canonical-contracts.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",

package/packages/core/artifact-signing.js

@@ -9,6 +9,7 @@ export const ARTIFACT_SIGNING_AUTHORITY_CONTRACT =
 
 const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const SOURCE_SHA_PATTERN = /^[0-9a-f]{40}$/u;
+const ENTITLEMENTS_PROFILES = new Set(["none", "jit-executable-v1"]);
 const FORBIDDEN_CREDENTIAL_KEYS =
   /(?:certificate|password|private.?key|secret|token|notary|issuer|team.?id|environment)/iu;
 
@@ -88,6 +89,64 @@ function exactSourceSha(value, label) {
   return normalized;
 }
 
+function entitlementsPaths(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) {
+    throw new Error("signing entitlements paths must be an array");
+  }
+  const paths = value.map((entry, index) => {
+    const normalized = nonEmptyString(
+      entry,
+      `signing entitlements paths[${index}]`,
+    );
+    const parts = normalized.split("/");
+    if (
+      normalized.startsWith("/") ||
+      normalized.includes("\\") ||
+      normalized.includes(",") ||
+      parts.some((part) => part === "" || part === "." || part === "..")
+    ) {
+      throw new Error(
+        `signing entitlements paths[${index}] must be a safe archive-relative path`,
+      );
+    }
+    return normalized;
+  });
+  if (new Set(paths).size !== paths.length) {
+    throw new Error("signing entitlements paths must not contain duplicates");
+  }
+  return paths;
+}
+
+function signingEntitlements(profileId, kind, signature) {
+  const profile = String(signature.entitlementsProfile || "none").trim();
+  const paths = entitlementsPaths(signature.entitlementsPaths);
+  if (!ENTITLEMENTS_PROFILES.has(profile)) {
+    throw new Error(
+      `unsupported signing entitlements profile: ${profile || "<empty>"}`,
+    );
+  }
+  if (
+    profile !== "none" &&
+    (profileId !== "apple-developer-id" || kind !== "archive")
+  ) {
+    throw new Error(
+      `signing entitlements profile ${profile} requires an Apple archive`,
+    );
+  }
+  if (
+    (profile === "none" && paths.length !== 0) ||
+    (profile !== "none" && paths.length === 0)
+  ) {
+    throw new Error(
+      "signing entitlements paths must be non-empty exactly when an entitlements profile is enabled",
+    );
+  }
+  return profile === "none"
+    ? {}
+    : { entitlementsProfile: profile, entitlementsPaths: paths };
+}
+
 function assertNoCredentialMaterial(value, path = "request") {
   if (!value || typeof value !== "object") return;
   for (const [key, child] of Object.entries(value)) {
@@ -191,6 +250,7 @@ export function createArtifactSigningRequest({
     platform,
     artifactKind: kind,
   });
+  const entitlementIntent = signingEntitlements(profile.id, kind, signature);
   const request = {
     schemaVersion: 1,
     contract: ARTIFACT_SIGNING_REQUEST_CONTRACT,
@@ -253,6 +313,7 @@ export function createArtifactSigningRequest({
       profile: profile.id,
       provider: profile.provider,
       semantics: profile.semantics,
+      ...entitlementIntent,
     },
     delivery: {
       mode: nonEmptyString(

package/packages/core/buildchain-config.js

@@ -61,6 +61,10 @@ const SUPPORTED_SIGNING_PROFILES = new Set([
   "windows-authenticode",
   "detached-signature-v1",
 ]);
+const SUPPORTED_SIGNING_ENTITLEMENTS_PROFILES = new Set([
+  "none",
+  "jit-executable-v1",
+]);
 const SUPPORTED_SIGNING_ARTIFACT_KINDS = new Set([
   "auto", "binary", "archive", "blob", "directory", "mach-o", "app-bundle",
   "framework-bundle", "plugin-bundle", "xpc-bundle", "dylib", "pkg", "dmg",
@@ -99,6 +103,27 @@ function normalizeStringArray(value, label) {
   return value.map((entry, index) => assertString(entry, `${label}[${index}]`));
 }
 
+function normalizeSigningEntitlementsPaths(value, label) {
+  const paths = normalizeStringArray(value, label);
+  for (const [index, entry] of paths.entries()) {
+    const parts = entry.split("/");
+    if (
+      entry.startsWith("/") ||
+      entry.includes("\\") ||
+      entry.includes(",") ||
+      parts.some((part) => part === "" || part === "." || part === "..")
+    ) {
+      throw new Error(
+        `${label}[${index}] must be a safe archive-relative path`,
+      );
+    }
+  }
+  if (new Set(paths).size !== paths.length) {
+    throw new Error(`${label} must not contain duplicate paths`);
+  }
+  return paths;
+}
+
 function getByDottedKey(target, key) {
   return String(key)
     .split(".")
@@ -362,7 +387,16 @@ function normalizeSigningSection(signing) {
   const artifacts = signing.artifacts.map((artifact, index) => {
     const label = `signing.artifacts[${index}]`;
     assertPlainObject(artifact, label);
-    const allowedKeys = new Set(["id", "path", "profile", "kind", "platforms", "required"]);
+    const allowedKeys = new Set([
+      "id",
+      "path",
+      "profile",
+      "entitlements_profile",
+      "entitlements_paths",
+      "kind",
+      "platforms",
+      "required",
+    ]);
     for (const key of Object.keys(artifact)) {
       if (!allowedKeys.has(key)) {
         throw new Error(`${label}.${key} is not supported; declare desired signature state only`);
@@ -377,10 +411,41 @@ function normalizeSigningSection(signing) {
     if (!SUPPORTED_SIGNING_ARTIFACT_KINDS.has(kind)) {
       throw new Error(`${label}.kind is not a supported signing artifact kind`);
     }
+    const entitlementsProfile =
+      artifact.entitlements_profile === undefined
+        ? "none"
+        : assertString(
+            artifact.entitlements_profile,
+            `${label}.entitlements_profile`,
+          );
+    if (!SUPPORTED_SIGNING_ENTITLEMENTS_PROFILES.has(entitlementsProfile)) {
+      throw new Error(
+        `${label}.entitlements_profile must be one of none or jit-executable-v1`,
+      );
+    }
+    if (entitlementsProfile !== "none" && kind !== "archive") {
+      throw new Error(
+        `${label}.entitlements_profile ${entitlementsProfile} requires kind = "archive"`,
+      );
+    }
+    const entitlementsPaths = normalizeSigningEntitlementsPaths(
+      artifact.entitlements_paths,
+      `${label}.entitlements_paths`,
+    );
+    if (
+      (entitlementsProfile === "none" && entitlementsPaths.length !== 0) ||
+      (entitlementsProfile !== "none" && entitlementsPaths.length === 0)
+    ) {
+      throw new Error(
+        `${label}.entitlements_paths must be non-empty exactly when entitlements_profile is enabled`,
+      );
+    }
     return {
       id: artifact.id === undefined ? artifactPath : assertString(artifact.id, `${label}.id`),
       path: artifactPath,
       profile,
+      entitlementsProfile,
+      entitlementsPaths,
       kind,
       platforms: normalizeStringArray(artifact.platforms, `${label}.platforms`),
       required: optionalBoolean(artifact.required, true),

package/packages/core/dev-delivery-proof.js

@@ -1,6 +1,7 @@
 import { devDeliveryClone as clone, devDeliveryContentRoot, devDeliveryExactRoot as exactRoot, devDeliveryExactSha as exactSha, devDeliveryPositiveInteger as positiveInteger, devDeliveryProtectedBase as protectedBase, devDeliveryRepository as repository, devDeliveryText as text, devDeliveryTimestamp as timestamp } from "./dev-delivery-common.js";
 
 export const SOURCE_QUALIFICATION_PROOF_SCHEMA = "kungfu.buildchain.source-qualification-proof/v1";
+export const SOURCE_QUALIFICATION_PROOF_V2_SCHEMA = "kungfu.buildchain.source-qualification-proof/v2";
 export const PROJECT_CUT_REPLAY_PROOF_SCHEMA = "kungfu.buildchain.project-cut-replay-proof/v1";
 export const INTEGRATION_DELIVERY_PROOF_SCHEMA = "kungfu.buildchain.integration-delivery-proof/v1";
 
@@ -49,10 +50,38 @@ export function createSourceQualificationProof(input = {}) {
   return { ...body, proofRoot: devDeliveryContentRoot(sourceQualificationIdentity(body)) };
 }
 
+export function createSourceQualificationProofV2(input = {}) {
+  const body = {
+    schema: SOURCE_QUALIFICATION_PROOF_V2_SCHEMA,
+    rootSemantics: SOURCE_QUALIFICATION_ROOT_SEMANTICS,
+    authority: "exact-source-qualification",
+    repository: repository(input.repository),
+    protectedBase: protectedBase(input.protectedBase),
+    qualifiedBase: exactSha(input.qualifiedBase, "qualifiedBase"),
+    sourceIdentityRoot: exactRoot(input.sourceIdentityRoot, "sourceIdentityRoot"),
+    sourceHead: exactSha(input.sourceHead, "sourceHead"),
+    sourceTree: exactSha(input.sourceTree, "sourceTree"),
+    sourcePatchRoot: exactRoot(input.sourcePatchRoot, "sourcePatchRoot"),
+    planRoot: exactRoot(input.planRoot, "planRoot"),
+    closureRoot: exactRoot(input.closureRoot, "closureRoot"),
+    dependencyRoot: exactRoot(input.dependencyRoot, "dependencyRoot"),
+    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
+    policyRoot: exactRoot(input.policyRoot, "policyRoot"),
+    requiredContextRoot: exactRoot(input.requiredContextRoot, "requiredContextRoot"),
+    controllerReceiptRoot: exactRoot(input.controllerReceiptRoot, "controllerReceiptRoot"),
+    sourceWorkflowRunId: positiveInteger(input.sourceWorkflowRunId, "sourceWorkflowRunId"),
+    affectedPaths: [...new Set((input.affectedPaths || []).map(text).filter(Boolean))].sort(),
+    shardEvidenceRoots: exactRoots(input.shardEvidenceRoots, "shardEvidenceRoots"),
+    qualifiedAt: timestamp(input.qualifiedAt, "qualifiedAt"),
+  };
+  body.observationRoot = devDeliveryContentRoot(sourceQualificationObservation(body));
+  return { ...body, proofRoot: devDeliveryContentRoot(sourceQualificationIdentity(body)) };
+}
+
 export function verifySourceQualificationProof(proofInput, expected = {}) {
   try {
     const proof = clone(proofInput || {});
-    if (proof.schema !== SOURCE_QUALIFICATION_PROOF_SCHEMA) return { ok: false, reason: "unsupported-schema" };
+    if (![SOURCE_QUALIFICATION_PROOF_SCHEMA, SOURCE_QUALIFICATION_PROOF_V2_SCHEMA].includes(proof.schema)) return { ok: false, reason: "unsupported-schema" };
     const proofRoot = proof.proofRoot;
     delete proof.proofRoot;
     if (proof.rootSemantics === undefined) {
@@ -65,7 +94,12 @@ export function verifySourceQualificationProof(proofInput, expected = {}) {
     for (const [field, value] of Object.entries(expected)) {
       if (value !== undefined && proof[field] !== value) return { ok: false, reason: `${field}-mismatch` };
     }
-    createSourceQualificationProof(proof);
+    if (proof.schema === SOURCE_QUALIFICATION_PROOF_V2_SCHEMA) {
+      if (proof.authority !== "exact-source-qualification") return { ok: false, reason: "non-exact-authority" };
+      createSourceQualificationProofV2(proof);
+    } else {
+      createSourceQualificationProof(proof);
+    }
     return { ok: true, reason: "exact-source-proof", proofRoot };
   } catch (error) {
     return { ok: false, reason: "invalid-proof", error: error.message };
@@ -80,7 +114,7 @@ export function classifyDevDeliveryDelta({ proof, current = {} } = {}) {
       reason: verification.reason,
       reusable: false,
     };
-  const exactPredicates = ["sourceIdentityRoot", "sourcePatchRoot", "planRoot", "closureRoot", "dependencyRoot", "toolchainRoot"];
+  const exactPredicates = ["sourceIdentityRoot", "sourcePatchRoot", "planRoot", "closureRoot", "dependencyRoot", "toolchainRoot", ...(proof.schema === SOURCE_QUALIFICATION_PROOF_V2_SCHEMA ? ["qualifiedBase", "sourceHead", "sourceTree", "policyRoot", "requiredContextRoot"] : [])];
   for (const field of exactPredicates) {
     if (!current[field] || current[field] !== proof[field]) {
       return {

package/packages/core/dev-delivery-warrant.js

@@ -5,7 +5,7 @@ import { DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA, createDevDeliveryTerminalSettle
 import { compareReleaseBlockerPriority, normalizeReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { devDeliveryContentRoot } from "./dev-delivery-common.js";
 export { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA, createReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
-export { SOURCE_QUALIFICATION_PROOF_SCHEMA, PROJECT_CUT_REPLAY_PROOF_SCHEMA, INTEGRATION_DELIVERY_PROOF_SCHEMA, classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "./dev-delivery-proof.js";
+export { SOURCE_QUALIFICATION_PROOF_SCHEMA, SOURCE_QUALIFICATION_PROOF_V2_SCHEMA, PROJECT_CUT_REPLAY_PROOF_SCHEMA, INTEGRATION_DELIVERY_PROOF_SCHEMA, classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, createSourceQualificationProofV2, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "./dev-delivery-proof.js";
 export { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA };
 export const DEV_DELIVERY_QUEUE_CONTRACT = "kungfu-buildchain-dev-delivery-warrant-queue";
 export const DEV_DELIVERY_WARRANT_SCHEMA = "kungfu.buildchain.dev-delivery-warrant/v1";
@@ -70,7 +70,7 @@ function normalizeCandidate(input, expected) {
     planRoot: exactRoot(input.planRoot, "planRoot"),
     closureRoot: exactRoot(input.closureRoot, "closureRoot"),
     dependencyRoot: exactRoot(input.dependencyRoot, "dependencyRoot"),
-    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
+    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"), ...(input.environmentRoot ? { environmentRoot: exactRoot(input.environmentRoot, "environmentRoot") } : {}), ...(Object.hasOwn(input, "sourceWorkflowRunId") ? { sourceWorkflowRunId: nonNegativeInteger(input.sourceWorkflowRunId, "candidate sourceWorkflowRunId", 0) } : {}),
     priority: priority(input.priority),
     enqueuedAt: timestamp(input.enqueuedAt, "candidate enqueuedAt"),
     updatedAt: timestamp(input.updatedAt || input.enqueuedAt, "candidate updatedAt"),
@@ -79,7 +79,7 @@ function normalizeCandidate(input, expected) {
     status,
     terminal: input.terminal || null,
   };
-  if (Object.hasOwn(input, "releaseBlockerPriority")) candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(input.releaseBlockerPriority, candidate, expected);
+  if (Object.hasOwn(input, "affectedPaths")) { if (!Array.isArray(input.affectedPaths)) throw new Error("candidate affectedPaths must be an array"); candidate.affectedPaths = [...new Set(input.affectedPaths.map(text).filter(Boolean))].sort(); } if (Object.hasOwn(input, "releaseBlockerPriority")) candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(input.releaseBlockerPriority, candidate, expected);
   return candidate;
 }
 

package/packages/core/index.js

@@ -639,6 +639,8 @@ export {
 } from "./kfd3-surface-register.js";
 
 export * from "./release-propagation.js";
+export * from "./v4-floating-consumer-policy.js";
+export * from "./v4-runtime-ref-resume-authority.js";
 
 export {
   RELEASE_ACTIVATION_CONTRACT,

package/packages/core/publication-authority.js

@@ -639,18 +639,18 @@ function validatePublicationEvidence(publicationEvidence, admission) {
     repository: admission.repository,
     targetChannel: releaseCandidateEvidenceChannel(admission.channel),
   });
-  if (!passportValidation.ok) {
-    throw new Error(`release-candidate passport did not qualify: ${passportValidation.errors.join("; ")}`);
-  }
+  if (!passportValidation.ok) throw new Error(`release-candidate passport did not qualify: ${passportValidation.errors.join("; ")}`);
+  const evidence = (key) => passport[key] ? { [key]: passport[key] } : {};
   const candidateHash = sha256Json({
     repository: passport.repository,
     target: passport.target,
     source: passport.source,
     platformMatrix: passport.platformMatrix,
     buildchain: passport.buildchain,
-    ...(passport.gateProfileEvidence ? { gateProfileEvidence: passport.gateProfileEvidence } : {}),
+    ...evidence("gateProfileEvidence"),
     ...(passport.familyEvidence ? { familyEvidence: passport.familyEvidence } : {}),
-    ...(passport.controllerReceipts ? { controllerReceipts: passport.controllerReceipts } : {}),
+    ...evidence("consumerPolicy"),
+    ...evidence("controllerReceipts"),
   });
   if (normalizeDigest(passport.candidateHash, "releaseCandidatePassport.candidateHash") !== candidateHash) {
     throw new Error("release-candidate passport candidate hash mismatch");